Re: [VOTE] release wss4j-1.5.4

[Fred Dushin]

It would sound good, if I could get a test case written....
AFAIK, what I want to do is, say,

 1. Sign the body of the message with a symmetric key (I assume I can  
use HMAC, here)
 2. Encrypt the symmetric key using a public key, and send it along  
in the header, as well

I suppose the ordering is irrelevant, since it looks like the  
Signature build operation in WSS4J will try to prepend the Signature  
element in the header, anyway.

I'm getting there, though.  Got step 1 done, and I think we have some  
code (test suite #14) for doing step 2, but it looks like that test  
requires that key be used to encrypt something (the body, in this  
case), as well.

If anyone has some code or insight to contribute, please do!  All I  
want to do is create and EncryptedKey, and stick it in the header (and  
get the Signature to reference the key, as well :)

-Fred

On May 23, 2008, at 1:57 PM, Ruchith Fernando wrote:

Sounds good !!

Thanks,
Ruchith

On Fri, May 23, 2008 at 8:02 PM, Fred Dushin <[EMAIL PROTECTED]>  
wrote:
Okay then.  Here is my plan:
*  Retract the call for votes for the 1.5.4 release to both the  
wss4j and
general lists (with due apologies)
*  On the 1_5_4 branch, Apply the patch for WSS-119, and obtain or  
write a
test case for it, as none has been submitted yet
*  Update changelog
*  Manually test against CXF
*  re-tag the release (or merge to the 1_5_4 tag)
*  Spin the bits (including site)
*  Call for votes
I should hopefully be able to get to this today.  If anyone has a  
test case
for WSS-119, this will make getting this done today more likely  
(Note that
Monday is a national holiday here in the states)
Note that after the vote passes, I will do the normal update  
procedures to
the web site, the distribution download area, and to maven.  Before  
I do
that, though, I will merge the changes that went on the fixes  
branch to the
mainline, as the branch and mainline have gone out of sync.  At  
that point,
the mainline will be "open" for merges.
If there are any objections, please let me know.
Thanks,
-Fred
On May 23, 2008, at 7:22 AM, Nandana Mihindukulasooriya wrote:

Hi Devs,
  Tested the release with the WSS-119 patch Axis2/Rampart and it  
works
fine.

thanks,
nandana

On Fri, May 23, 2008 at 3:21 PM, O hEigeartaigh, Colm
<[EMAIL PROTECTED]> wrote:

Fred,

https://issues.apache.org/jira/browse/WSS-51

and

https://issues.apache.org/jira/browse/WSS-54

can be closed imo, as the patches have long since been applied.

+1 to getting a fix for WSS-119 into the release for 1.5.4, but I  
think
that any other issue that appears should be deferred to 1.5.5 or  
2.0.

Colm.

-----Original Message-----
From: Fred Dushin [mailto:[EMAIL PROTECTED]
Sent: 22 May 2008 21:48
To: wss4j-dev
Subject: Re: [VOTE] release wss4j-1.5.4

Okay, I've fixed the hard-coded references to WSS4J versions in  
any of
the docs, and I've added a ChangeLog.txt, which I generated from
Jira.  I've also added a Jira report to the maven plugin, so we can
see which tickets were closed for 1.5.4.

A test version of the site can be found at:

http://people.apache.org/~fadushin/stage/wss4j/1.5.4/site/

Note that at present, the release bits have NOT been updated on
people.apache.org, and the tags/1_5_4 branch has not been updated,
either.

Before re-spinning a release, I'd like to take a vote on whether we
can release without a fix for

http://issues.apache.org/jira/browse/WSS-119

I'd say that if WSS-119 is not a regression, then we should release
without the fix.  OTOH, if there is a strong feeling towards making
the fix, then I'd be open to that, too -- it does apparently affect
WCF interop, which is pretty important, IMO.  It will require that  
we
withdraw the release, and start the test cycle over again.  So  
far, it
looks like Axis, CXF, and Tuscany are the parties with a stake in
that.  (The CXF testing I can do very easily)

I can't say how far away we'd be on a 1.5.5, or even a 2.0 release.

Also, could I ask whether any WSS4J contributors would like to be
listed in the contributors section of the web site?  Speak up, and
I'll add your name, but I don't want to add names without permission
-- well, except for Colm :)

-Fred

On May 22, 2008, at 1:00 PM, Ruchith Fernando wrote:

Fred,

Can we get these issues fixed that cut the release again please?

Thanks,
Ruchith

On Mon, May 19, 2008 at 11:36 PM, Tom Jordahl <[EMAIL PROTECTED]>
wrote:
Hi Fred,

I took a look and would be happy to +1 the release with the  
following
comments:

- In the README.txt file, this version number was not updated
"Thus no specific installation is required. The wss4j-1.5.1.jar  
file
could be included into ear or war files of enterprise or web
application
servers."

I would recommend not listing an explicit version number in this
section
to avoid future problems.

- I could find no change log as to what bug fixes or enhancements
1.5.4
made over the previous releases.

- The front page for WSS4J has some broken links and lists the
current
release as 1.5.0 when in fact only 1.5.1, 1.5.2 and 1.5.3 are
available
from the download site.


--
Tom Jordahl
WS PMC member

-----Original Message-----
From: Fred Dushin [mailto:[EMAIL PROTECTED]
Sent: Monday, May 19, 2008 10:48 AM
To: [EMAIL PROTECTED]
Cc: wss4j-dev
Subject: Fwd: [VOTE] release wss4j-1.5.4

To the Apache Web Services community,

We are currently in the process of a WSS4J 1.5.4 release, but we  
have
only gotten 1 +1 vote from an Apache WS PMC member.  (The only  
other
votes cast have been 2 non-binding +1 votes).

Could I ask Apache WS PMC members to look into this release?

Here is the email trail on the vote:


http://mail-archives.apache.org/mod_mbox/ws-wss4j-dev/200805.mbox/thread

(using the subject "[VOTE] release wss4j-1.5.4")

Many thanks,

Fred Dushin
(release engineer for the Apache WSS4J 1.5.4 release)

Begin forwarded message:

From: Fred Dushin <[EMAIL PROTECTED]>
Date: May 13, 2008 11:02:41 AM EDT
To: wss4j-dev <wss4j-dev@ws.apache.org>
Subject: [VOTE] release wss4j-1.5.4

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is a call for votes for the wss4j-1.5.4 release.  This  
release
has the same set of fixes as RC3, and should only differ in the
version name.

The distribution can be found at the following URL:

http://people.apache.org/~fadushin/stage/wss4j/1.5.4/dist/

You can also point maven at the following URL to pull down the  
1.5.4
release POM, source, and class JARs:

http://people.apache.org/~fadushin/stage/wss4j/1.5.4/maven/

This vote will stay open for at least 72 hours.

Thank you for all the effort made towards this release!

Here is my (non-binding and advisory) +1

- -Fred
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFIKa1LKSQw0yA4Kl8RAoB0AKC+lD69QY4Q6tkwFk1ygWIAjRwuggCfXWA2
51quHxthvKqCIak6oWoXcDA=
=upU1
-----END PGP SIGNATURE-----


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]





--
http://blog.ruchith.org
http://wso2.org

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

----------------------------
IONA Technologies PLC (registered in Ireland)
Registered Number: 171387
Registered Address: The IONA Building, Shelbourne Road, Dublin 4,  
Ireland

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]






--
http://blog.ruchith.org
http://wso2.org



---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]